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DETAILED ACTION 

1 . Claims 1 -50 have been examined. 

Drawings 

2. New corrected drawings are required in this application because the drawings 
are informal. Applicant is advised to employ the services of a competent patent 
draftsperson outside the Office, as the U.S. Patent and Trademark Office no longer 
prepares new drawings. The corrected drawings are required in reply to the Office 
action to avoid abandonment of the application. The requirement for new drawings will 
be held in abeyance until a Notice of Allowance is submitted. 

Claim Objections 

3. Claims 36 and 39 are objected to because of the following informalities: 
regarding claim 36, the sentence is not grammatical (see lines 10 and 1 1 ); regarding 
claim 39, on line 6, the phrase "at least part the at least one storage device" should read 
"at least part of the at least one storage device". Appropriate correction is required. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
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invention was made to a person having ordinary sicill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. This application currently names joint inventors. In considering patentability of 
tine claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of 
the various claims was commonly owned at the time any inventions covered therein 
were made absent any evidence to the contrary. Applicant is advised of the obligation 
under 37 CFR 1 .56 to point out the inventor and invention dates of each claim that was 
not commonly owned at the time a later invention was made in order for the examiner to 
consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) 
prior art under 35 U.S.C. 103(a). 

6. Claims 1-16, 18-42, and 44-50 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Wells U.S. Patent No. 6,338,141 (hereinafter Wells) in view of Frisch 
Essential Svstem Administration (hereinafter Frisch) and Kim "The Design and 
Implementation of Tripwire: A File System Integrity Checker" (hereinafter Kim). As per 
claim 1 , Wells discloses a method of detecting computer viruses on a single, stand- 
alone computer system or on a networked machine using an antivirus unit (see Wells, 
abstract). Wells does not expressly disclose providing a disk space having at least a 
portion that is partitioned into separate segments, each segment being accessed by at 
least one of a plurality of hosts, wherein a first one of the segments is accessed using a 
different file system than a second one of the segments. However, this configuration is 
found in several operating systems. For example, Frisch teaches a UNIX operating 
system that enables a flexible partitioning capability wherein each partitioned segment 
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is accessed using a different file system (see Frisch, pages 409-414 'From Disks to 
Filesystems', especially page 409, first paragraph in the section). It would be obvious to 
one of ordinary skill in the art at the time the invention was made for the method of 
detecting a virus to be actuated on a disk space having at least a portion that is 
partitioned into separate segments, each segment being accessed by at least one of a 
plurality of hosts, wherein a first one of the segments is accessed using a different file 
system than a second one of the segments. Motivation for such an implementation 
enables an administrator broader control to allow or restrict access to information on a 
disk by segmenting the disk on a partition level as taught by Frisch (see Frisch, page 
394, 2"^^ and 3'^ paragraphs). 

7. Further, Wells does not expressly disclose scanning for a virus on a portion of 
the disk that includes a part of the first and second segments. However, means of 
selectively checking the integrity of separate filesystems on a disk is a feature of the 
UNIX tool Tripwire. Kim teaches how different filesystems on a disk can be checked by 
entering the paths of relevant filesystems as well as corresponding selection-masks, 
which classifies how to observe changes in the filesystem, in the Tripwire configuration 
file (see Kim, page 11, Figure 2 and related text). Furthermore, Kim teaches Tripwire as 
a function operating in a larger security methodology: the results of a Tripwire check can 
be used by a filter program (see Kim, page 12, 2""* paragraph, 'quiet option'); likewise, 
the invention disclosed by Wells teaches each function of the antivirus unit can be used 
independently (see Wells, col. 1 , lines 48-61 ). The combination of Tripwire and the 
antivirus unit disclosed by Wells forms a methodology such that Tripwire implements a 
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integrity check of selected portions of the disk and the invention of Wells processes the 
information from Tripwire to selectively scan for potentially infected files and handle 
detected viruses accordingly. It would be obvious to one of ordinary skill in the art at the 
time the invention was made to selectively scan separate filesystems on a disk space 
for viruses. Motivation for such an implementation enables the flexibility to secure any 
suspicious subset of data on a disk, even across partitioned boundaries. The 
aforementioned covers claim 1 . 

8. As per claim 2, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, the first and second segments correspond to 
different physical portions of the disk space (see Frisch, page 410, Figure 9-3). 

9. As per claim 3, Wells covers a method as outlined above in the claim 2 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments overlap (see Frisch, pages 39-41, Links). It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for the first and second segments to overlap to enable information pertinent to multiple 
segments to be shared between the segments as taught by Frisch. 

10. As per claim 4, Wells covers a method as outlined above in the claim 2 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments do not overlap (see Frisch, page 395, Figure 9- 
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I , disk 1 ). It would be obvious to one of ordinary skill in the art at the time the invention 
was made for the first and second segments to not overlap to organize segments into 
distinct logical partitions as taught by Frisch. 

II. As per claim 5, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments correspond to logical entities (see Frisch, page 
395, Figure 9-1 , disk 1 ). It would be obvious to one of ordinary skill in the art at the time 
the invention was made for the first and second segment to correspond to logical 
entities since it enables a direct correlation between a physical partition and a logical 
partition as taught by Frisch. 

12. As per claim 6, Wells covers a method as outlined above in the claim 5 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments overlap (see Frisch, pages 39-41 , Links). It 
would be obvious to one of ordinary skill in the art at the time the invention was made 
for the first and second segments to overlap to enable information pertinent to multiple 
segments to be shared between the segments as taught by Frisch. 

1 3. As per claim 7, Wells covers a method as outlined above in the claim 5 rejection 
under 35 U.S.C. 1 03(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein the first and second segments do not overlap (see Frisch, page 395, Figure 9- 
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1 , disk 1 ). It would be obvious to one of ordinary skill In the art at the time the invention 
was made for the first and second segments to not overlap to organize segments into 
distinct logical partitions as taught by Frisch. 

14. As per claim 8, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, the part of the disk space that is scanned by the 
antivirus unit corresponds to particular types of files stored in the disk space (see Wells, 
col. 9, lines 1-4). 

15. As per claim 9, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches identifying files that have been 
modified since a previous scan and using a filter program to generate an automated 
action in response to the Identified files, and Wells teaches scanning selected files by 
an antivirus unit as an independent function within a larger collective antivirus 
methodology (see Kim, page 11, section 4.2, tw.config selection-mask combination: +m; 
page 12, 2"" paragraph; see Wells, col. 1, lines 54-60). It would be obvious to one of 
ordinary skill in the art at the time the invention was made to apply the teaching of Kim 
to the method covered by Wells to ensure the integrity of a file has not been breached 
since a previous scan (see Kim, page 1 , last line-page 2, first line; page 10, section 
4.1.3). 



Application/Control Number: 09/715,643 Page 8 

Art Unit: 2132 

16. As per claim 10, Wells covers a method as outlined above in the claim 9 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches examining a date of last modification 
for each of the files; and determining which files have been modified since a previous 
scan using the date of last modification for each of the files (see Kim, page 1 1 , section 
4.2, tw.config selection-mask combination: +m). It would be obvious to one of ordinary 
skill in the art at the time the invention was made to apply the teaching of Kim to the 
method covered by Wells to ensure the integrity of a file has not been breached since a 
previous scan (see Kim, page 1, last line-page 2, first line; page 10, section 4.1.3). 

17. As per claim 1 1 , Wells covers a method as outlined above in the claim 10 
rejection under 35 U.S.C. 103(a). In addition. Wells and Kim teach scanning the file for 
viruses in response to a date of last modification indicating a file has been modified 
since a previous virus scan (see Wells, col. 1, lines 54-60; see Kim, page 12, 2"'' 
paragraph). It would be obvious to one of ordinary skill in the art at the time the 
invention was made to apply the teaching of Kim to the method covered by Wells to 
ensure the integrity of a file has not been breached since a previous scan (see Kim, 
page 1, last line-page 2, first line; page 10, section 4.1 .3). 

1 8. As per claim 1 2, Wells covers a method as outlined above in the claim 1 1 
rejection under 35 U.S.C. 103(a). In addition. Wells and Kim teach comparing a current 
size of the file with a previous size of the file determined during the previous virus scan 
in response to date information indicating that a file has not been modified since a 
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previous virus scan; and in response to the current size being different from tlie 
previous size, rescanning the file (see Kim, page 11, section 4.2, tw.config selection- 
mask combination: +ms; page 12, 2"'' paragraph; see Wells, col. 1 , lines 54-60). It 
would be obvious to one of ordinary skill in the art at the time the invention was made to 
apply the teaching of Kim to the method covered by Wells to ensure the integrity of a file 
has not been breached since a previous scan (see Kim, page 1, last line-page 2, first 
line; page 10, section 4.1.3). 

19. As per claim 13, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim teaches implementing at least part of Tripwire 
using stand-alone hardware (see Kim, page 12, section 4.3.1). It would be obvious to 
one of ordinary skill in the art at the time the invention was made to implement at least 
part of the antivirus unit using stand-alone hardware to ensure the inviolability of the 
integrity database used by Tripwire (see Kim, page 12, section 4.3.1, first paragraph in 
the section, 2"'' sentence). 

20. As per claim 14, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch and Kim teach implementing at least part of 
the antivirus unit as a process running on at least one of the hosts (see Frisch, page 43, 
'Processes'; see Kim, page 10, section 4.1.2, 'Scalability' and section 4.1.3, 
'Configurability and flexibility'; see Wells, col. 3, lines 1 0-1 1 ). It would be obvious to one 
of ordinary skill in the art at the time the invention was made for a part of the antivirus 
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unit be a process running on at least one of the hosts since any application run on a 
nnachine connprises at least one process on the machine: as defined by Frisch, a 
process is a single program running in its own virtual address space (see Frisch, page 
43, last paragraph, first sentence). 

21 . As per claim 15, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches the useable areas of a disk space 
are partitioned into separate segments in any given partitioned disk (see Frisch, page 
395, Figure 9-1, diski; page 410, Figure 9-3). It would be obvious to one of ordinary 
skill in the art at the time the Invention was made for the useable areas of the disk 
space to be partitioned into separate segments to enable each disk partition to be 
usable to a user or application. 

22. As per claim 16, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Wells and Kim teach the antivirus unit scans 
useable areas of the disk space (see Kim, page 11, Figure 2; see Wells, col. 1, lines 54- 
60). It would be obvious to one of ordinary skill in the art at the time the invention was 
made for the antivirus unit to scan useable areas of the disk space since these areas 
are workspaces having read/write privileges for users and applications and are prone to 
integrity attacks when a virus attains these privileges. 
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23. As per claim 1 8, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the UNIX OS 
wherein a particular segment assigned to a first host is inaccessible to other hosts (see 
Frisch, page 29, Table 2-3, 'no access'; page 30, 5"" line 'Other Access' and Figure 2-1 ; 
pages 228-229 'Using Groups Effectively", especially page 228, 4'*^ paragraph, second 
sentence). It would be obvious to one of ordinary skill in the art at the time the invention 
was made for a particular segment assigned to a first host to be inaccessible to other 
hosts for the purpose of enforcing non-use of those who do not require access to a 
segment (see Frisch, page 228, 4'^ paragraph, second sentence). 

24. As per claim 19, Wells covers a method as outlined above in the claim 18 
rejection under 35 U.S.C. 103(a). In addition, Frisch teaches an embodiment of the 
UNIX OS wherein all of the segments are at least readable by the antivirus unit (see 
Frisch, page 29, Table 2-3, 'read access only'; page 30, 3'^^ line 'Group access' and 
Figure 2-1; pages 228-229 'Using Groups Effectively', especially page 228, 3'*^ 
paragraph, first sentence and 4^'' paragraph, last sentence).. It would be obvious to one 
of ordinary skill in the art at the time the invention was made for all of the segments to 
be readable by the antivirus unit to enable the antivirus unit to comprehensively check 
the integrity of the disk (see Frisch, page 228, 3''^ paragraph, first sentence and 4"" 
paragraph). 
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25. As per claim 20, Wells covers a method as outlined above in the claim 1 rejection 
under 35 U.S.C. 103(a). In addition, Kim and Frisch teach that at least a portion of the 
antivirus unit is provided on at least some controllers for disks corresponding to the disk 
space (see Kim, page 11 , Figure 2, first entry '/etc' and Section 4.2; see Frisch, pages 
398-405, The Filesystem Configuration File', especially page 398, Vetc/fstab'). It would 
be obvious to one of ordinary skill in the art at the time the invention was made for a 
portion of the antivirus unit to be provided on at least some controllers for disks 
corresponding to the disk space to enable a comprehensive integrity check 
methodology. 

26. As per claim 21 , Wells covers a method as outlined above in the claim 20 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches Tripwire is provided with file 
structure information for files stored in the disk space (see Kim, page 1 1 , section 4.2, 
tw.config selection-mask +in). It would be obvious to one of ordinary skill in the art at 
the time the invention was made for the antivirus unit to be provided with file structure 
information for files stored in the disk space to enable the unit to check for integrity 
inconsistencies in the file structure as taught by Kim. 

27. As per claims 22-25, Wells covers a method as outlined above in the claim 1 -1 6 
and 18-21 rejections under 35 U.S.C. 103(a). In addition, Kim teaches a first scan at a 
first time and a second scan at a second time after the first fime, wherein the results of 
the first scan are taken into consideration in the performing of the second scan as 
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outlined in the invention covered in the claim 1-16 and 18-21 rejections (see Kim, page 
14, section 4.5). It would be obvious to one of ordinary skill in the art at the time the 
invention was made for there to be a first virus scan at a first time and a second virus 
scan at a second time after the first time and dependent on the results of the first scan 
since the scans are automated on a periodic basis and the integrity of the segments 
must be accounted for consistent with preceding scans starting with the inception of the 
checks to ensure integrity is maintained over the course of multiple periods (see Kim, 
page 14, section 4.5, 1^^ paragraph of the section, 3''^ sentence). The aforementioned 
cover claims 22-25. 

28. As per claims 26-35, they are apparatus claims corresponding to claims 1-12 and 
they do not teach or define above the information claimed in claims 1-12. Therefore, 
claims 26-35 are rejected as being unpatentable over Wells in view of Frisch and Kim 
for the same reasons set forth in the rejections of claims 1-12. 

29. As per claims 36-38, they are apparatus claims corresponding to claims 22-25 
and they do not teach or define above the information claimed in claims 22-25. 
Therefore, claims 36-38 are rejected as being unpatentable over Wells in view of Frisch 
and Kim for the same reasons set forth in the rejections of claims 22-25. 

30. As per claims 39, 42 and 44-46, they are apparatus claims corresponding to 
claims 1, 13, 14 and 20, and they do not teach or define above the information claimed 
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in claims 1, 13, 14 and 20. Tlierefore, claims 39, 42 and 44-46 are rejected as being 
unpatentable over Wells in view of Frisch and Kim for the same reasons set forth in the 
rejections of claims 1, 13, 14 and 20. 

31 . As per claim 40, Wells covers an antivirus unit as outlined above in the claim 39 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches an embodiment of Tripwire 
wherein the means for coupling includes means for coupling to only one storage device 
(see Kim, pages 14-15, section 5). It would be obvious to one of ordinary skill in the art 
at the time the invention was made for the means for coupling to include means for 
coupling to only one storage device to provide a personal integrity checking means (see 
Kim, page 14, section 5, 1^' paragraph in the section). 

32. As per claim 41 , Wells covers an antivirus unit as outlined above in the claim 39 
rejection under 35 U.S.C. 103(a). In addition, Kim teaches an embodiment of Tripwire 
wherein the means for coupling includes means for coupling to more than one storage 
device (see Kim, page 10, section 4.1.2, 'Scalability'). It would be obvious to one of 
ordinary skill in the art at the time the invention was made for the means for coupling to 
include means for coupling to more than one storage device to share one configuration 
of the integrity checker across a multitude of storage devices for a consistent integrity 
check methodology across the storage network (see Kim, page 10, section 4.1.2, 1^' 
and 2"'' paragraph in the section). 
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33. As per claims 47-50, they are apparatus claims corresponding to claims 13, 20, 
22 and 23, and they do not teach or define above the information claimed in claims 13, 
20, 22 and 23. Therefore, claims 47-50 are rejected as being unpatentable over Wells 
in view of Frisch and Kim for the same reasons set forth in the rejections of claims 13, 
20, 22 and 23. 

34. Claim 17 is rejected under 35 U.S.C. 103(a) as being unpatentable over Wells in 
view of Frisch and Kim, and further in view of Stang "Comparison: Products to Detect 
Changes to Programs" (hereinafter Stang). As per claim 17, Wells covers a method as 
outlined above in the claim 1 rejection under 35 U.S.C. 103(a). Wells does not specify 
the antivirus unit scanning a portion of the disk space independently of any file 
structures corresponding to the disk space. Stang discloses several integrity checkers 
that scans disk space independently of any file structures corresponding to the disk 
space (see Stang, page 14, 'Checkup' and The Detective'). It would be obvious to one 
of ordinary skill in the art at the time the invention was made for the antivirus unit to 
scan independent of any file structures. Motivation for such a combination simplifies the 
scanning procedure by scanning everything on the disk as taught by Stang. 

35. Claim 43 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over Wells in 
view of Frisch and Kim, and further in view of Tso et al. U.S. Patent No. 6,088,803 
(hereinafter Tso). As per claim 43, Wells covers a method as outlined above in the 
claim 42 rejection under 35 U.S.C. 103(a). Wells does not specify an embodiment 



Application/Control Number: 09/71 5,643 Page 1 6 

Art Unit: 2132 

wherein the antivirus unit is interposed between the at least one storage device and the 
at least one host. Tso discloses an antivirus accelerator for connputer networks wherein 
an antivirus unit is interposed between a storage device and a host, wherein files 
requested by the host is first scanned by the antivirus unit then submitted to the host if 
no virus is detected (see Tso, figure 1 and related text). It would be obvious to one of 
ordinary skill in the art at the time the invention was made to apply the apparatus of Tso 
to the apparatus of Wells. Motivation for such a combination safeguards information 
being transferred from a storage unit to a host as taught by Tso (see Tso, col. 1 , lines 
48-55). 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

Chi U.S. Patent No. 6,006,329. 
Waldin et al. U.S. Patent No. 6,094,731. 

Kleimola "Experimenting with countermeasures Appendix C: Tripwire". 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jung W Kim whose telephone number is (703) 305- 
8289. The examiner can normally be reached on M-F 9:00-6:00. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron can be reached on (703) 305-1830. The fax phone number 
for the organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

Jung W Kim 
Examiner 
Art Unit 2132 

Jk 

July 14, 2004 





